Re: [Iot-onboarding] [Secdispatch] DANE IOT proposed outcome

[Michael Richardson <[e-mail]>]

Hi, I don't want to religate the email again.
I accept pretty much all your claims, except that:

> I can run my own CA if I need to... But the need to do so diminishes if
> DANE allows me to avoid name collisions and to perform mutual auth without
> having to distribute CA certificates.

This seems to imply that running a private CA is at least an order of
magnitude harder than managing a DNS zone containing TLSA records,
and which is probably DNSSEC signed.

It is unclear to that your application needs either: it seems like it just
needs a database of public keys which are authorized, and you already seem to
assume the existence of a radius server with a database backend.
I think that radius servers can be as complex as signed DNS zones, or simple private CAs.

I'm sorry to be obtuse here: others will ask the question.

It sounds like your application is primarily a mp2p data flow (device->cloud).
I'm finding it difficult to see why a DNS zone full of TLSA records is even
required.

If we get into e2e  (m2m) data flows, then the ability for one device to
validate another device without directly communicating with a third party is
a win.  For that, a private CA or a DNS zone of TLSA keys, particularly, as
you say, that DNSSEC record cache proposal, makes perfect sense to me.

My proposal going forward:
   section 2 of draft-huque-dane-client-cert

needs to expand to a couple of pages.

The SMTP use case should probably get it's own section; perhaps its own
document actually.

I think that:
       TLS Extension for DANE Client Identity
           draft-huque-tls-dane-clientid-03

is clear and simple, and once we figure out where huque-dane-client-cert
goes, then I think that this document should just be referred to the TLS WG.
The previous document should then provide adequate explanation of the
context.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide